Looks like there was a breaking change in stemcell v3541.2 where the default umask was set to 077. If this stemcell is used with BOSH-deployed-Concourse.CI v3.9.0, resource checking fails with a “permission denied” error.
Note that Pivotal (as of Feb 22 2018) has not updated their stemcells to 3541.x and their latest is still in the 3468 chain.
Brian Ragazzi 